Automatic over-the-air Device OS updates now enabled for cellular devices

Yes
https://docs.particle.io/reference/device-os/firmware/boron/#system-calls

There is no event you can see in console that precedes the update, but once the device “acknowledges” the update and starts downloading the binary an event is triggered.

OK. So from the device side I can disable an OTA update. Can I do it from the Cloud Side, like I can lock a device to a particular firmware?

Right now I am accomplishing this through locking devices to particular firmware versions.

That only works for product devices.